tapp/filament-google-autocomplete-field

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge, which warrants review because that workflow class can expose elevated repository context. No untrusted checkout or script-injection patterns were detected.

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a potential installation-time behavior to review, but the provided signal does not show a dangerous script or make the package unfit to use.

Maintainerscaution

Only one registry account has publish access, which is a modest publishing continuity concern. The linked repository is owned by an organization, providing some compensation for the narrow registry access list.

Repo bus factorcaution

All recent commit activity is from one contributor, creating concentration risk. Because the repository is organization-owned and another contributor is documented in the v4.2.0 release notes, the risk is meaningful but not severe.

Repo commit activitycaution

The repository recorded only 1 commit in the last 3 months from 1 active maintainer, indicating slow recent development. The strong release history and recent v4.2.0 release partly compensate for this snapshot.